license-policy.json

{
  "_comment": "Machine-readable license and vulnerability policy for Glassbox. Keep in sync with .cargo/deny.toml. See docs/license-policy.md for the full policy rationale.",
  "schema_version": "1",
  "updated": "2026-07-29",

  "allowed_licenses": [
    "Apache-2.0",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "CC0-1.0",
    "Unlicense",
    "0BSD",
    "BlueOak-1.0.0",
    "Unicode-DFS-2016",
    "Zlib",
    "OpenSSL",
    "Python-2.0",
    "PSF-2.0",
    "Apache-2.0 WITH LLVM-exception"
  ],

  "disallowed_licenses": [
    "GPL-2.0",
    "GPL-2.0-only",
    "GPL-2.0-or-later",
    "GPL-3.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
    "AGPL-1.0",
    "AGPL-3.0",
    "AGPL-3.0-only",
    "AGPL-3.0-or-later",
    "LGPL-2.0",
    "LGPL-2.1",
    "LGPL-2.1-only",
    "LGPL-2.1-or-later",
    "LGPL-3.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
    "SSPL-1.0",
    "BUSL-1.1",
    "OSL-3.0",
    "CPAL-1.0",
    "Commons-Clause",
    "Proprietary"
  ],

  "ambiguous_licenses": {
    "description": "Licenses that require manual review before use. A finding for any of these identifiers fails the build and requires an explicit exception entry.",
    "list": [
      "CC-BY-4.0",
      "CC-BY-SA-4.0",
      "OFL-1.1",
      "EPL-1.0",
      "EPL-2.0",
      "CDDL-1.0",
      "CPOL-1.02",
      "SISSL"
    ]
  },

  "vulnerability_policy": {
    "fail_on": "HIGH",
    "severities": {
      "CRITICAL": "fail",
      "HIGH":     "fail",
      "MEDIUM":   "warn",
      "LOW":      "ignore"
    },
    "max_exception_days": 90,
    "description": "CRITICAL and HIGH CVEs block the release. MEDIUM findings are uploaded as scan artifacts but do not block. Exceptions require documentation and a hard expiry date."
  },

  "exceptions": [],

  "false_positive_policy": {
    "description": "Entries here downgrade UNKNOWN license findings to warnings when the scanner cannot parse the LICENSE file. Each entry must include evidence_url.",
    "entries": []
  }
}